const { URL } = require('url');

/**
 * Anti-hotlinking middleware. Ensures that requests for assets originate
 * from the official app domain (SYSTEM_HOST). Blocks direct URL access.
 */
const verifyReferer = (req, res, next) => {
    // Cho phép các Bot của mạng xã hội truy cập để lấy ảnh thumbnail
    const userAgent = req.headers['user-agent'] || '';
    const isSocialBot = /facebookexternalhit|Facebot|ZaloBot|Twitterbot|Slackbot|LinkedInBot|Embedly/i.test(userAgent);
    
    if (isSocialBot) {
        return next();
    }

    const referer = req.headers.referer;
    const origin = req.headers.origin;
    const systemHost = process.env.SYSTEM_HOST || 'http://localhost:5000';

    let allowedOrigin;
    try {
        allowedOrigin = new URL(systemHost).origin;
    } catch (e) {
        allowedOrigin = systemHost;
    }

    const isMatch = (headerValue) => {
        if (!headerValue) return false;
        try {
            const urlObj = new URL(headerValue);
            const incomingOrigin = urlObj.origin;
            // Cho phép nếu khớp hoàn toàn origin
            if (incomingOrigin === allowedOrigin) return true;
            // Trong môi trường development, cho phép localhost với bất kỳ port nào
            const isLocal = incomingOrigin.includes('localhost') || incomingOrigin.includes('127.0.0.1') || incomingOrigin.includes('::1');
            if (process.env.NODE_ENV !== 'production' && isLocal) return true;
            return false;
        } catch (e) {
            return false;
        }
    };

    const hasValidReferer = isMatch(referer);
    const hasValidOrigin = isMatch(origin);

    // Block request if both referer and origin are missing or do not match SYSTEM_HOST
    if (!hasValidReferer && !hasValidOrigin) {
        return res.status(403).json({ 
            message: 'Access denied: Hotlinking detected or direct file access is prohibited.' 
        });
    }

    next();
};

/**
 * Cache prevention middleware. Ensures that sensitive image assets are never
 * cached by client browsers or intermediate proxies.
 */
const setNoCacheHeaders = (req, res, next) => {
    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
    res.setHeader('Pragma', 'no-cache');
    res.setHeader('Expires', '0');
    next();
};

module.exports = {
    verifyReferer,
    setNoCacheHeaders
};